A missing authorization check in Frappe ERPNext allows any authenticated user, including portal or no role users, to call the get_bom_items endpoint and retrieve detailed BOM data such as raw materials, quantities, rates and costs. This flaw can expose confidential cost and inventory information. It represents a confidentiality breach without affecting system integrity or availability directly.

The vulnerability exists in frappe:erpnext versions earlier than 15.121.4 and earlier than 16.36.0. Users running these releases should verify their installed version against the critical thresholds identified in the vendor advisories.

The CVSS score of 7.1 indicates a medium-to-high severity. While no EPSS score is provided, the vulnerability is not listed in the CISA KEV catalog. The likely attack path involves an authenticated API call or web request to the exposed get_bom_items endpoint; an attacker needs to be logged in but does not require elevated roles. Once accessed, the attacker can exfiltrate all BOM information for any specified item, compromising confidentiality within the organization.